CVE-2026-25722 is a validation flaw in Claude Code before 2.0.57. Combining the cd command with a write let an attacker create or change files in protected folders such as .claude without a confirmation prompt. NVD scores it 9.1. Version 2.0.57 fixes it.
What's affected
- Product: Claude Code, Anthropic's agentic coding tool (npm package @anthropic-ai/claude-code).
- Affected: versions before 2.0.57.
- Fixed: 2.0.57.
- Precondition from the advisory: reliable exploitation required adding untrusted content into the Claude Code context window.
How to check if you're exposed
Check the installed version on each developer machine and in any CI image:
claude --version
npm ls -g @anthropic-ai/claude-code
The advisory says users on standard auto update received the fix automatically, while people who update manually are advised to move to the latest version.
What to do now
- Update Claude Code to 2.0.57 or later, ideally the current release.
- Pin the version in CI images and developer containers, and rebuild them.
- Treat untrusted content (pasted issues, third party files, web pages) as hostile before it enters a session.
- Review the .claude directory in projects you opened with untrusted material for files you did not write.
- Keep confirmation prompts on for write operations.
Why it matters
The record lists CWE-20, improper input validation, and CWE-78, OS command injection. The protection that guards sensitive folders looked at the target path but did not account for a directory change made earlier in the same command, so the check and the write disagreed about where the file was going.
The folder at stake matters because settings in .claude can influence how the tool behaves later. The advisory is careful to say that exploitation needed attacker text inside the model's context, which is a real precondition rather than a footnote. The record does not mark this CVE as exploited in the wild.
How to prioritise the fix
This one is about the habits around the tool as much as the version. The advisory says reliable exploitation needed untrusted content in the context window, so think about what your developers feed into sessions: issue text, pasted logs, third party repositories and web pages.
Updating is quick and auto update covers most users. The manual part is the fleet: pinned versions in dev containers, CI images and shared machines. Make a list of those places and check each with claude --version. Then look at the .claude directory of any project that was opened with material you did not write.
Quick check
Do I need to do anything if I have auto update on?
The advisory says auto update users got the fix automatically. Confirm with claude --version that you are on 2.0.57 or later.
Sources
Last reviewed: 19 October 2026.
